if (forward != null) {
return forward;
}
SubjectManagerLocal subjectManager = LookupUtil.getSubjectManager();
Subject subject = WebUtility.getSubject(request);
int subjectSession = subject.getSessionId();
Subject userToBeModified = subjectManager.getSubjectById(pForm.getId());
String userName = userToBeModified.getName();
log.debug("Editing password for user [" + userName + "]");
boolean admin = LookupUtil.getAuthorizationManager().hasGlobalPermission(subject, Permission.MANAGE_SECURITY);
boolean isSameUser = subject.getName().equals(userName);
// if this user cannot administer other user's passwords, make sure he gave the old password as confirmation
if (!admin) {
try {
int dummySession = subjectManager.loginLocal(userName, pForm.getCurrentPassword()).getSessionId();
subjectManager.logout(dummySession);
// The above killed our session for subject if subject == userToBeModified
if (isSameUser) {
subject = subjectManager.loginLocal(userName, pForm.getCurrentPassword());
}
} catch (LoginException e) {
RequestUtils.setError(request, "admin.user.error.WrongPassword", "currentPassword");
return returnFailure(request, mapping, ParamConstants.USER_PARAM, pForm.getId());
}
}
String newPassword = pForm.getNewPassword();
subjectManager.changePassword(subject, userName, newPassword);
// when we have arrived here, the password is changed.
// If this was a change of our own password, we need to re-login now
if (isSameUser) {
subjectManager.logout(subject.getSessionId());
}
return returnSuccess(request, mapping, ParamConstants.USER_PARAM,
pForm.getId());